SaTQuML: Secure and Trustworthy Quantum Machine Learning brings together researchers working at the intersection of quantum machine learning (QML), cybersecurity, trustworthy AI, quantum security, and cyberdefense. As QML moves toward practical testing on hybrid quantum-classical platforms, its use in security-sensitive settings must be guided by clear benchmarks, realistic threat models, strong baselines, and careful evaluation.
The workshop focuses on two connected themes. The first is the security and trustworthiness of QML systems themselves, including robustness, privacy, reliability, interpretability, deployment risks, model leakage, and behavior under noisy hardware conditions. The second is the use of QML and hybrid quantum-classical methods for cyberdefense and related security applications, including anomaly detection, malware analysis, intrusion detection, vulnerability prioritization, cyber-physical security, and threat intelligence.
QML is entering an important transition period. Academic research groups and industry platforms are making hybrid quantum-classical experimentation increasingly accessible through open-source software, simulators, cloud-based access to quantum computers, and early application-driven demonstrations. This creates a need to evaluate QML beyond expressivity, trainability, and quantum-advantage claims, with attention to realistic data, reproducibility, robustness, privacy, security, and deployment constraints.
SaTQuML emphasizes rigorous evaluation over speculative claims. Its central goal is to help define meaningful research problems, strong classical and quantum baselines, realistic threat models, reproducible benchmarks, and shared best practices for secure and trustworthy QML systems in security-critical settings.
NeurIPS 2026 Workshop on SaTQuML: Secure and Trustworthy Quantum Machine Learning invites submissions from researchers working on secure, reliable, and realistic quantum machine learning. We welcome work on trustworthy QML systems, rigorous benchmarking, cyberdefense applications, and secure deployment. See the scope section below for the broader workshop motivation and focus.
Submit papers through the SaTQuML submission portal on OpenReview.
Primary themes for the workshop include:
Example subtopics and concrete directions include:
This is the tentative schedule of the workshop. All slots are provided in local time.
| 08:00 - 08:10 | Introduction and Opening Remarks |
| 08:10 - 08:40 | Keynote Talk 1: Samuel Yen-Chi Chen, Wells Fargo |
| 08:40 - 08:45 | Break |
| 08:45 - 09:15 | Keynote Talk 2: Muhammad Usman, CSIRO |
| 09:15 - 09:20 | Break |
| 09:20 - 09:50 | Keynote Talk 3: Swaroop Ghosh, Pennsylvania State University |
| 09:50 - 10:05 | Break |
| 10:05 - 10:15 |
What does it cost to trust a quantum model? Shot-priced certification
for hybrid
QML
Pavel Sulimov (Zurich University of Applied Sciences), Claude Lehmann (Zurich University of Applied Sciences; University of Zurich) |
| 10:15 - 10:25 |
QCBA: Quantum Coalescence Backdoor Attack against Quantum Convolutional
Neural
Networks
Junrui Zhang (Old Dominion University), Zemin Chen (Old Dominion University), Yao Wang (Old Dominion University), Jiang Li (Old Dominion University), Chunsheng Xin (Iowa State University), Hongyi Wu (The University of Arizona), Rui Ning (Old Dominion University) |
| 10:25 - 10:35 |
Responsible Quantum Adoption in Distributed Human-AI Systems: A
Role-Separated
Benchmark
Luyao Zhang (Duke Kunshan University) |
| 10:35 - 10:40 |
QAELL: Toward Quantum-Assisted Energy-Landscape Learning for Anomaly
Detection
Jingjing Wang (Beijing QBoson Quantum Technology Co., Ltd.), Chang Wu (Beijing QBoson Quantum Technology Co., Ltd.; Beijing Normal University), Chao Ju (Beijing QBoson Quantum Technology Co., Ltd.), Qi Gao (Beijing QBoson Quantum Technology Co., Ltd.), Yin Ma (Beijing QBoson Quantum Technology Co., Ltd.), Hai Wei (Beijing QBoson Quantum Technology Co., Ltd.), Kai Wen (Beijing QBoson Quantum Technology Co., Ltd.) |
| 10:40 - 10:45 |
What It Costs to Copy a Hybrid Quantum Head
Samanyu Goyal (California High School) |
| 10:45 - 10:50 |
Error mitigation and fidelity certification share a fixed point
Aarush Pandey (Indian Institute of Technology Delhi), Inderpreet Kaur (Indian Institute of Technology Delhi), Monika Aggarwal (Indian Institute of Technology Delhi) |
| 10:50 - 10:55 |
Trustworthy Machine Learning in the Real-Time Decoding Loop
Krishna Harish (Houston Community College), Ishant Ghimiray (Columbus State University) |
| 10:55 - 11:00 |
CryptHarness: A Harness for Agent-Assisted Cryptanalytic Research
Nico Pelleriti (Technical University Berlin; Zuse Institute Berlin), Nicolai Kraus (Ruhr University Bochum), Alexander May (Ruhr University Bochum), Sebastian Pokutta (Technical University Berlin; Zuse Institute Berlin) |
| 11:00 - 12:00 | Panel Discussion: Secure and Trustworthy QML |
| 12:00 - 14:00 |
Lunch and Poster Session All accepted papers will be presented as posters for extended discussion and Q&A. View poster papers |
| 14:00 - 14:30 | Keynote Talk 4: Juan Cruz-Benito, IBM Quantum and IBM Research |
| 14:30 - 14:35 | Break |
| 14:35 - 15:05 | Keynote Talk 5: Soohyun Park, Sookmyung Women's University |
| 15:05 - 15:10 | Break |
| 15:10 - 15:20 |
When Normalization Selects the Sign: Auditing Robustness Ablations in
Quantum
Attention
Owen Friedewald (University of Missouri), Srikar Alla (University of Missouri), Ali Shiri Sichani (University of Missouri), Chi-Ren Shyu (University of Missouri) |
| 15:20 - 15:30 |
CRAE-GUARD: Clean-Referenced Absolute Evidence for Sampling-Robust
Quantum
Backdoor Detection
Zemin Chen (Old Dominion University), Yao Wang (Old Dominion University), Junrui Zhang (Old Dominion University), Lusi Li (Old Dominion University), Daniel Takabi (Old Dominion University), Rui Ning (Old Dominion University) |
| 15:30 - 15:40 |
Shots Are Not Enough: Mask Coverage and Shot Precision in Adversarial
Evaluation
of Stochastic Quantum Neural Networks
Pablo Rivas (Marist University) |
| 15:40 - 15:50 |
Where Quantum Fourier Sampling Stops Short: A Three-Gate Audit Protocol
for
Delay-PUF Security Models
Owen Friedewald (University of Missouri), Ali Shiri Sichani (University of Missouri), Chi-Ren Shyu (University of Missouri) |
| 15:50 - 15:55 |
Adaptive-Shot Hybrid Quantum Anomaly Detection for Tactile Internet
Security:
Reliability-Aware Measurement Allocation Under Resource Constraints
Mubassir Serneabat Sudipto (Iowa State University), Shakil Ahmed (Grand Valley State University), Ashfaq Khokhar (Kansas State University), Samir M. Iqbal (Grand Valley State University) |
| 15:55 - 16:00 |
Linter-Guided Repair of Quantum Code Smells
Greta Dolcetti (Ca' Foscari University of Venice), Giulio Zizzo (IBM Research), Liubov Nedoshivina (IBM Research), Juan Cruz-Benito (IBM Research), Nicolas Dupuis (IBM Research) |
| 16:00 - 16:05 |
Four Forks: Evaluation Choices Decide the Conclusion in Meta-Learned
Initialization for Variational Quantum Algorithms
Junyong Lee (Yonsei University), Seokhyeon Son (Yonsei University), Jeihee Cho (Yonsei University), Euimin Lee (Yonsei University), Hyeonseong Jung (Yonsei University), Daniel Justice (Carnegie Mellon University), Shiho Kim (Yonsei University) |
| 16:05 - 16:10 |
Trustworthy Evaluation of Quantum Message Passing: Isolating Circuit
Contributions in Traffic Forecasting
Firas Elhag (University of Tennessee at Chattanooga), Tam Bang (University of Tennessee at Chattanooga), Mina Sartipi (University of Tennessee at Chattanooga), Hoang H. Nguyen (University of Tennessee at Chattanooga) |
| 16:10 - 16:15 |
When Error Mitigation Makes Things Worse: Budget-Aware Evaluation,
Extrapolation
Failure, and the Calibration Trust Boundary
Guilin Zhang (Workday AI Research), Kai Zhao (Workday AI Research), Xiquan Cui (Workday AI Research), Henry Heng (Workday AI Research), Xu Chu (Workday AI Research), Aletta Johanna Blanken (Workday AI Research) |
| 16:15 - 16:30 | Awards and Closing Remarks |
All accepted papers will participate in the poster session to facilitate extended discussion and Q&A. The papers listed below are poster-only presentations.
SaTQuML 2026 accepts three submission types: Tiny Papers (2 pages), Short Papers (4 pages), and Long Papers (9 pages). Reviewers should evaluate each paper according to the expectations of its submission type rather than applying the same standard across all tracks.
Tiny papers are intended for focused, early-stage, or emerging ideas. Reviewers should assess whether the submission is scientifically sound, relevant to SaTQuML, clearly motivated, and potentially useful to the research community. Preliminary results, negative results, concise observations, benchmark ideas, open problems, and promising new directions are welcome. Tiny papers are not expected to provide the experimental depth or completeness of a full paper.
Short papers should present a meaningful and technically credible contribution with appropriate analysis or preliminary evidence where applicable. The work may still be developing and does not need the breadth of evaluation expected from a Long Paper. Reviewers should focus on scientific soundness, relevance, clarity, and whether the contribution can stimulate useful discussion or further research.
Long papers should be evaluated with a higher standard of rigor, technical depth, and completeness. Reviewers should consider the significance and novelty of the contribution, methodological soundness, adequacy of the evaluation, strength of evidence supporting the claims, comparison with relevant prior work, and clarity of presentation.
For Tiny and Short Papers, we encourage reviewers to be receptive to scientifically sound work that contributes useful ideas, evidence, or discussion to the SaTQuML community, even when the work is preliminary. Long Papers should meet a stronger bar for technical depth, evaluation, and completeness.
For all submission types, reviewers should assess whether the submission represents genuine scholarly work. Concerns about fabricated results or citations, inappropriate use of generative AI, plagiarism, or other research-integrity issues should be flagged to the Program Chairs with specific evidence rather than inferred solely from writing style.